That plastic rectangle you tap against the door barely registers as a thought.
You slide it in a slot, the light blinks green, you push inside and forget it exists.
But security researchers and privacy advocates have been poking at hotel key cards for years, and what they keep finding should make any frequent traveler pause.
Most key cards aren't simple magnets anymore.
Many modern hotel locks run on RFID or NFC chips, the same short-range wireless tech inside your credit card and passport.
They're convenient, but they quietly broadcast a small amount of data when prompted.
The card itself usually holds only a room number and an expiration window, which sounds harmless until you consider who else can read it.
A widely cited test by security consultant Cody Brocious in 2012 showed how certain Onity electronic locks could be opened with a homemade device costing under fifty dollars.
Onity later issued a fix, but the episode exposed a larger truth: the hotel industry has thousands of properties, and upgrades roll out slowly.
Budget chains and older buildings are often running hardware that predates the smartphone in your pocket.
Then there's the question of what happens after checkout.
A 2003 study from the University of California, San Diego found that a surprising number of discarded cards still contained personal information, including names, partial credit card numbers, and home addresses.
The researchers bought used cards on eBay and recovered readable data from a chunk of them.
That was two decades ago, and while practices have tightened, the underlying risk never fully disappeared.
Your room key is tied to a reservation profile that may include your phone number, email, loyalty account, travel companions, and spending patterns at the hotel bar.
Data brokers and marketing firms pay good money for that kind of travel behavior, and hotel privacy policies are often written to allow "trusted partners" access.
A growing number of properties, from major chains to boutique independents, have experimented with biometric check-in.
The reality is that your face becomes a credential stored somewhere on someone's server, governed by terms you almost certainly didn't read.
Combine that with key card data and you have a fairly complete picture of a person moving through space and time.
Carry your own RFID-blocking sleeve if you're paranoid, though that mostly protects the card from being skimmed in your pocket.
Ask the front desk to wipe your card at checkout, and watch them do it if you want.
Pay with a card that isn't linked to your primary bank, and think twice before downloading that hotel app that wants location access "for your convenience." None of this means you should sleep in your car.
Hotels are still safer than most alternatives, and the vast majority of stays go off without a hitch.
But the next time you drop that key card in the checkout box, remember it's not just a piece of plastic.
Final Thoughts
It's a small node in a network that knows more about you than you think.